10 · Networking Performance¶

Domain 3 — Design High-Performing Architectures · 24%

Two clusters of questions: connecting networks privately (VPC peering, Transit Gateway, VPC endpoints, Direct Connect, VPN) and getting traffic to users fast (Route 53 routing policies, CloudFront, Global Accelerator). The exam tests which option fits a described requirement — this page is the decision map.

Core concept¶

A VPC is your private network in AWS (subnets, route tables, gateways). Networking-performance questions ask one of two things:

How do I connect this VPC to another network — another VPC, on-prem, or an AWS service — privately and at the right performance?
How do I route users to the fastest/healthiest endpoint and reduce latency globally?

Connecting networks — the options¶

Option	Connects	Use when
VPC Peering	VPC ↔ VPC (1:1)	A few VPCs need private connectivity. Non-transitive, no overlapping CIDRs
Transit Gateway	Many VPCs + on-prem (hub)	Connecting many VPCs/accounts and VPN/DX at scale — replaces a messy peering mesh; transitive
VPC Endpoints	VPC → AWS services (private)	Reach AWS services without the internet. Gateway endpoint (free) = S3 & DynamoDB; Interface endpoint (PrivateLink, hourly) = most others
Site-to-Site VPN	On-prem ↔ VPC over internet	Quick, cheap, encrypted (IPsec); performance varies with the internet
Direct Connect (DX)	On-prem ↔ AWS, dedicated line	Consistent low latency / high bandwidth; private. Takes weeks to provision; not encrypted by itself

Two frequently tested nuances:

VPC peering is non-transitive — if A↔B and B↔C are peered, A still can't reach C. Need many-to-many → Transit Gateway.
Direct Connect gives consistent performance but isn't encrypted; for a private link that's also encrypted, run a VPN over Direct Connect. For a quick encrypted link, use Site-to-Site VPN alone (accepting variable internet performance). A common resilient design is DX with a VPN backup.

Route 53 routing policies (know all of these)¶

Policy	Routes based on	Typical use
Simple	One record, no logic	Single resource
Weighted	Assigned proportions	A/B testing, canary/gradual rollout
Latency-based	Lowest network latency to a Region	Global apps, fastest response
Failover	Health of primary → secondary	Active-passive DR
Geolocation	User's location	Compliance, localization, geo-restricted content
Geoproximity	Geographic distance (with bias)	Shift traffic toward/away from a Region
Multivalue answer	Up to 8 healthy records, health-checked	Simple client-side load spreading

Cues: lowest latency → Latency-based (not Geolocation!); route by where the user is → Geolocation; active-passive failover → Failover; gradual/canary → Weighted.

Alias records

Use a Route 53 Alias record (free) to point a domain — including the zone apex (e.g. example.com) — at AWS resources like an ELB, CloudFront, or S3 website. A plain CNAME can't be used at the zone apex, so "map the root domain to an ELB" → Alias.

CloudFront vs Global Accelerator (a favourite distinction)¶

Both use AWS's global edge network, but they solve different problems:

	CloudFront	Global Accelerator
What it does	Caches content at edge locations	Routes traffic over the AWS backbone to the nearest healthy endpoint
Best for	Static/dynamic web content (HTTP/S)	Non-HTTP (TCP/UDP): gaming, VoIP, IoT — or when you need static anycast IPs
Caching	Yes	No
IP	Edge-served	2 static anycast IPs
Failover	—	Instant cross-Region failover

Reflex: caching web content → CloudFront; improve performance/availability of TCP/UDP apps, or need static IPs and fast regional failover → Global Accelerator.

Intra-VPC performance (brief)¶

For very high-throughput, low-latency communication between instances (HPC, tightly coupled clusters): use a cluster placement group (packs instances close together in one AZ) plus enhanced networking (ENA) for high bandwidth. Contrast with a spread placement group (instances on distinct hardware for availability) and a partition placement group (large distributed workloads like HDFS/Cassandra).

Worked example — lowest latency vs by-location¶

A global app runs in us-east-1, eu-west-1, and ap-southeast-1. The team wants each user's DNS query to resolve to the Region that gives that user the fastest response. Someone proposes Geolocation routing "so users go to the nearest Region."

Is Geolocation right?

Answer

No — use Latency-based routing. Geolocation routes by the user's geographic location (great for compliance or serving localized content), but "nearest by geography" is not the same as "lowest network latency" — the fastest path can cross a border. Since the requirement is explicitly fastest response / lowest latency, the correct policy is Latency-based routing, which sends each user to the Region with the lowest measured latency for them. (Add Route 53 health checks so unhealthy Regions are skipped.)

Exam traps¶

VPC peering is non-transitive and forbids overlapping CIDRs; many VPCs → Transit Gateway.
Gateway endpoint = S3 & DynamoDB only (free); Interface endpoint (PrivateLink) = most others.
Direct Connect = consistent/low-latency but not encrypted; add a VPN over DX for encryption; VPN alone is the quick, cheap, encrypted (but internet-variable) option.
Latency-based ≠ Geolocation. Fastest → Latency-based; by-location → Geolocation.
Alias record (not CNAME) to point the zone apex at an ELB/CloudFront/S3.
CloudFront caches content; Global Accelerator routes traffic (no caching) — GA for TCP/UDP / static IPs / instant failover.
Failover routing = active-passive; Weighted = canary/gradual; Multivalue = health-checked client-side spread.

Practice questions¶

Q1. A company has 12 VPCs across several accounts that all need private connectivity to each other and to an on-premises data center, managed centrally. What should they use?

A. A full mesh of VPC peering connections
B. AWS Transit Gateway
C. Internet gateways in each VPC
D. Separate VPN tunnels between every pair of VPCs

Answer: B

B. Transit Gateway is a central hub that connects many VPCs and on-prem (VPN/DX) with transitive routing — far simpler than a peering mesh. VPC peering (A) is non-transitive and becomes an unmanageable mesh at this count. Internet gateways (C) expose traffic to the internet. Pairwise VPNs (D) don't scale either.

Q2. An application must send DNS users to the AWS Region that provides them the lowest latency. Which Route 53 routing policy?

A. Geolocation
B. Latency-based
C. Weighted
D. Simple

Answer: B

B. Latency-based routing sends each user to the Region with the lowest measured latency. Geolocation (A) routes by the user's location, which isn't necessarily the fastest path. Weighted (C) splits by proportion; Simple (D) has no such logic.

Q3. A real-time multiplayer game uses UDP and needs low-latency, highly available global routing with static IP addresses and instant failover between Regions. Which service?

A. Amazon CloudFront
B. AWS Global Accelerator
C. Amazon Route 53 weighted routing
D. Amazon S3 Transfer Acceleration

Answer: B

B. Global Accelerator provides two static anycast IPs, routes UDP/TCP traffic over the AWS backbone to the nearest healthy endpoint, and fails over across Regions almost instantly. CloudFront (A) is an HTTP content cache, not for UDP game traffic. Weighted routing (C) doesn't optimize latency or give static IPs. Transfer Acceleration (D) is for S3 uploads.

Q4. EC2 instances in a VPC must access Amazon S3 without their traffic traversing the public internet, at no additional cost for the connection. What should be configured?

A. A NAT gateway
B. A VPC gateway endpoint for S3
C. An interface endpoint (PrivateLink) for S3
D. An internet gateway

Answer: B

B. A gateway VPC endpoint provides private access to S3 (and DynamoDB) via route tables at no additional charge. A NAT gateway (A) sends traffic to the internet and bills hourly + per GB. An interface endpoint (C) works for many services but is the wrong (billed) type for S3 when a free gateway endpoint exists. An internet gateway (D) is public egress, the opposite of the requirement.

Q5. A company needs a consistent, low-latency, high-bandwidth private connection from its data center to AWS for a latency-sensitive workload. Which option best meets this?

A. Site-to-Site VPN over the internet
B. AWS Direct Connect
C. VPC peering
D. A public internet gateway

Answer: B

B. Direct Connect is a dedicated private physical connection offering consistent low latency and high bandwidth — ideal for latency-sensitive hybrid workloads (add a VPN over it if encryption is required). Site-to-Site VPN (A) runs over the internet with variable performance. VPC peering (C) connects VPCs, not on-prem. An internet gateway (D) is public and not private/consistent.

Next: 11 · Compute & Storage Cost Optimization → · Revise — Networking Performance